5db5-equalizer-lv2-bin

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

• PKGBUILD:11 source=('https://5db5public.s3.amazonaws.com/Equalizer551Linux.zip')

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs prebuilt binary shared libraries (.so files) for an audio plugin from a proprietary vendor (Audio Assault, audioassault.mx). The source is an S3 bucket (5db5public.s3.amazonaws.com) which is a plausible vendor-controlled distribution host for a small audio plugin company, not a random personal bucket. The URL pattern and plugin name are consistent with the vendor's product page linked in the url= field. A sha256 checksum is provided, which mitigates substitution risk at build time. However, the concern is real: prebuilt binary blobs (.so libraries that get loaded into audio hosts) from a non-official package repository, distributed via an S3 bucket with no source code, represent a genuine supply-chain risk — if the S3 object were replaced, users who don't verify checksums would execute arbitrary code. The license is a proprietary EULA. This is a classic medium-severity case: executed binary from an unofficial/vendor-controlled host with no source, but with a checksum and a plausible legitimate vendor connection.